New York, Connecticut AGs settle with Boston Children’s Health Physicians and XTIUM for $2.7 million

What happened

• Boston Children’s Health Physicians and its IT provider XTIUM settled an investigation by the New York and Connecticut Attorneys General into a August 2024 breach that exposed data of nearly 890,000 individuals.
• The breach stemmed from XTIUM’s insecure remote‑access tool and inadequate logging, allowing attackers to exfiltrate unencrypted patient billing records.
• The settlement includes a $4 million penalty, $2.7 million of which is payable to the states, with $1.3 million suspended pending compliance.
• Both parties must implement specific cybersecurity measures, and the suspended amount will be triggered if they fail to meet them.

Why it matters

Healthcare organisations that rely on third‑party IT managers must audit remote‑access configurations, enforce least‑privilege accounts and ensure robust logging to avoid similar enforcement actions.

Business impact

Non‑compliance could result in multi‑million‑dollar penalties and mandatory security upgrades, affecting budgets and operational timelines.

What to check

1. 1

   Secure remote‑access toolsHigh priority

   Apply all recommended security settings and restrict administrative privileges.

2. 2

   Implement comprehensive logging and monitoringHigh priority

   Enable continuous audit trails for all privileged access and remote sessions.

3. 3

   Enforce least‑privilege principlesHigh priority

   Remove shared admin accounts and limit permissions to only what is necessary.

4. 4

   Segment networksMedium priority

   Isolate critical patient data systems from other IT environments.